Cybersecurity
CISA says three Linux kernel flaws are exploited
CISA said three Linux kernel vulnerabilities were being exploited, set a same-day deadline for federal mitigation, and disclosed no details about the incidents or the threat actors involved.
- CISA said attackers were exploiting three Linux kernel vulnerabilities.
- It ordered federal agencies to apply updates and mitigations by the end of the day.
- STAR Labs said it found CVE-2025-39964 and demonstrated privilege escalation and container escape in Google’s kernelCTF.
- Red Hat said public exploits existed for CVE-2025-39682 and a known exploit existed for CVE-2026-53266.
CISA warned that three Linux kernel flaws were under active exploitation. It said the issues had been added separately the previous week and ranged from medium to critical in severity, and it said CVE-2025-39964 had existed for 14 years.
The agency put all three on its highest-priority list for federal bodies and told them to apply fixes and mitigations by the end of the day. It also said affected assets should be checked for signs that exploitation had already happened.
CISA said the flaws had been used in attacks but gave no details about the incidents or the threat actors. It also said none of the three had been linked to ransomware groups.
STAR Labs said it found CVE-2025-39964 without help from an AI system and showed privilege escalation and container escape. Red Hat said public exploits existed for CVE-2025-39682 and a known exploit existed for CVE-2026-53266, while Kimmo Suominen published analysis and a patch-status tracker for CVE-2026-53266 and said his exploitation chain was only inferred from Dirty Pipe.
Named in this story
People
- Kimmo Suominen
- published a technical analysis and patch-status tracker for CVE-2026-53266
Companies
- STAR Labs
- said it found CVE-2025-39964 and demonstrated it
- Red Hat
- said exploits were available for CVE-2025-39682 and CVE-2026-53266
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- warned that three Linux kernel flaws were being exploited and set the federal deadline
Products and systems
- Linux kernel
- contained the three vulnerabilities discussed in the report
- CVE-2025-39964
- one of the three kernel flaws CISA said was under active exploitation
- CVE-2026-53266
- one of the three kernel flaws CISA said was under active exploitation
- CVE-2025-39682
- one of the three kernel flaws CISA said was under active exploitation
How the source tells it
The source read as a plain technical security notice, with no distinct emotive framing.
No emotive framing was found in the original.